Advanced

SARIF & SIEM export

Ship Talos findings into your existing security tooling.

Talos emits SARIF 2.1.0 for GitHub Code Scanning and generic JSON for Splunk, Datadog, or any log pipeline that ingests structured events.

SARIF

Add --sarif to any scan. The resulting file lives at ./reports/scan.sarif and can be uploaded via the codeql-action/upload-sarif action.

For SIEMs that want events one-per-line, pass --json --stream. Each line is a self-contained finding document.

shell

❯ talos-scan --target $STAGING --adapter native --json --stream | \
  curl -X POST $SPLUNK_HEC/services/collector/event -d @-